Privacy Policy

PRIVACY POLICY
for MySolas Pty Ltd (ACN 674 932 784)
Registered Office: Level 8, 243 Edward Street, Brisbane City, QLD 4000, Australia
Effective Date: 20 August 2026

Privacy at a glance 

MySolas collects only information reasonably necessary to operate its disability community platform, Provider memberships, MySolas Match and recruitment service. 

Identifiable Participant information is shared with potential Providers only after the Participant or authorised Representative gives written consent. 

MySolas does not store Participant documents. Providers enter specific registration and verification details through the Platform. 

Recruitment candidate information is shared with a Provider only with the candidate's written consent. Candidate profiles are retained for future vacancies only where the candidate consents. 

Microsoft Teams AI note-taking may transcribe and summarise recruitment interviews. Candidates must be informed before this functionality is activated. 

1. Introduction 

1.1 MySolas Pty Ltd ACN 674 932 784 (MySolas, we, us or our) is committed to the lawful, fair and transparent handling of personal information. 

1.2 This Privacy Policy explains how MySolas collects, holds, uses, discloses, secures, retains and otherwise handles personal information in connection with the Platform and related services. 

1.3 MySolas manages personal information in accordance with the Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs), the Notifiable Data Breaches scheme and other privacy, communications and disability-sector laws that apply to its activities. 

1.4 This Privacy Policy is a transparency document and does not by itself create blanket consent to every handling activity described in it. Where consent is required, including for sensitive information, Participant referrals, recruitment disclosures or AI-assisted interview notes, MySolas will seek consent in an appropriate form. 

1.5 This Policy should be read with the MySolas Terms and Conditions and any collection notice presented when personal information is collected. 

2. Scope 

2.1 This Policy applies to personal information handled by MySolas about: 

• Participants, family members, carers, nominees, guardians and authorised Representatives; 
• Providers, Provider personnel, independent support workers and organisations; 
• Job Seekers and recruitment candidates; 
• event organisers and attendees, Marketplace users and accommodation advertisers or enquirers; 
• website visitors, account holders, community contributors and persons who contact MySolas; and 
• employees, contractors, volunteers, business contacts and other individuals whose information is handled in connection with MySolas operations. 

2.2 This Policy applies to MySolas Careers, Events, Marketplace, Insights, Social, MySolas Match, Provider memberships, recruitment services, enquiries, communications and any related feature operated by MySolas. 

2.3 A third party linked from or integrated with the Platform may have its own privacy policy. MySolas is not responsible for independent third-party privacy practices, although MySolas remains responsible for its own selection, configuration and use of service providers as required by law. 

3. Definitions 

3.1 APPs means the Australian Privacy Principles in the Privacy Act 1988 (Cth). 

3.2 Personal information means information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether true or not and whether recorded in material form or not. 

3.3 Platform means the website at https://www.mysolas.com.au and associated MySolas services, portals, communications and functionality. 

3.4 Provider means a person or organisation offering or supplying supports, services, employment, accommodation, events, products or other opportunities through MySolas. 

3.5 Representative means a parent, guardian, nominee, carer or other person authorised to act for a Participant. 

3.6 Sensitive information means personal information of a type given additional protection under the Privacy Act, including health and disability information, racial or ethnic origin, sexual orientation, criminal record and certain professional or association information. 

4. Information MySolas collects 

4.1 Account and contact information 

4.1.1 MySolas may collect names, preferred names, dates of birth, email addresses, telephone numbers, postal or service locations, account identifiers, authentication information, profile images, communication preferences and relationship or representative details. 

4.2 Participant and support information 

4.2.1 Where reasonably necessary for MySolas Match or another requested service, MySolas may collect NDIS status or participant number, disability and health-related information, support needs, goals, preferences, service type, service location, availability, accessibility requirements, cultural or communication preferences, funding-management information and details of the Participant's authorised Representative. 

4.2.2 MySolas does not store Participant documents as part of its ordinary service. Users should not upload or send identity documents, NDIS plans, medical records or other documents unless MySolas specifically requests them through an approved and secure process. 

4.3 Provider and organisation information 

4.3.1 MySolas may collect business names, ABNs or ACNs, trading details, addresses, service areas, contact persons, service categories, NDIS registration status, insurance details, worker screening or compliance status, professional credentials, experience, availability, pricing, account-user details and other information entered during Provider registration or verification. 

4.3.2 Providers enter specific registration and verification details into the Platform. MySolas does not ordinarily retain copies of Provider identity or compliance documents unless a document is specifically requested and a separate collection notice explains the purpose and handling arrangements. 

4.4 Recruitment information 

4.4.1 For the MySolas recruitment service, MySolas may collect a candidate's contact details, work history, employment preferences, availability, interview responses, salary or remuneration expectations, qualifications, right-to-work information, referee details, reference-check responses, screening or compliance status and documents voluntarily supplied by the candidate. 

4.4.2 MySolas conducts candidate interviews and reference checks. Candidates are responsible for providing other required evidence, including police checks, NDIS Worker Screening evidence, right-to-work documents and qualification records. MySolas will collect only the information reasonably necessary to assess and present the candidate for relevant roles. 

4.5 Platform content and communications 

4.5.1 MySolas may collect information in profiles, listings, posts, comments, reviews, messages, enquiries, complaints, support requests, event registrations, Marketplace communications, job advertisements and applications. 

4.5.2 Information a User chooses to publish in a public profile, listing, post, comment or review may be visible to other Users or the public. Private account information and private messages are not public unless the User chooses to share them or disclosure is otherwise permitted by law. 

4.6 Payment and transaction information 

4.6.1 MySolas may collect billing names, addresses, transaction references, subscription status, payment history, invoice information and limited payment-method details. Stripe processes payment card information. MySolas does not store complete payment card numbers or security codes. 

4.7 Technical, usage and tracking information 

4.7.1 When a person uses the Platform, MySolas and its service providers may collect IP address, device identifiers, browser and operating-system information, login activity, pages viewed, links selected, approximate location, session information, referral source, error logs, feature interactions and security events. 

4.7.2 The Platform uses technologies that may include cookies, local storage, Google Analytics, Google Tag Manager, Meta Pixel and similar analytics, advertising, security and performance tools. These technologies may recognise a browser or device and generate information about website use. 

4.8 Unsolicited information 

4.8.1 If MySolas receives personal information it did not request, MySolas will assess within a reasonable period whether it could lawfully have collected that information. If not, MySolas will take reasonable steps to destroy or de-identify it, provided it is lawful and reasonable to do so. 

5. Sensitive information and consent 

5.1 MySolas collects sensitive information only where the individual consents and the information is reasonably necessary for MySolas functions, or where collection is otherwise permitted or required by law. 

5.2 Sensitive information may include disability and health information, cultural or linguistic information, racial or ethnic origin, criminal record, sexual orientation or gender identity where voluntarily disclosed, NDIS Worker Screening information and other safeguarding or compliance information. 

5.3 Consent must be informed, voluntary, current and sufficiently specific. MySolas may seek express consent through a form, checkbox, email, recorded affirmative response or other method appropriate to the sensitivity and context, and will keep an appropriate record of consent. 

5.4 An individual may withdraw consent for future handling that depends on consent. Withdrawal does not invalidate earlier lawful handling and may mean that MySolas cannot continue a requested service. 

6. How MySolas collects information 

6.1 MySolas generally collects personal information directly from the individual through account registration, Platform forms, enquiries, interviews, messages, applications, posts, service requests, events, payment activity, cookies and direct communications. 

6.2 MySolas may collect information from an authorised Representative, Provider, referee, prospective employer, publicly available source, government register, regulator, verification service or other third party where the individual consents, would reasonably expect the collection, or collection is otherwise permitted by law. 

6.3 Where MySolas collects personal information from someone other than the individual, it will take reasonable steps to notify the individual of relevant collection matters where required. 

6.4 If a person does not provide requested information, MySolas may be unable to create or verify an account, perform a match, provide recruitment services, process a payment, investigate a complaint or make particular Platform functions available. 

7. Purposes for handling personal information 

7.1 MySolas may collect, hold, use and disclose personal information for purposes including: 

• creating, administering, securing and verifying accounts; 
• operating Provider profiles, memberships, listings, messages, events, Careers, Marketplace, Social, Insights and accommodation functions; 
• understanding Participant needs, obtaining consent and performing MySolas Match; 
• providing recruitment services, interviewing candidates, checking references and presenting consented candidates to Providers; 
• processing Membership payments, invoices, renewals, cancellations and billing enquiries; 
• communicating service information, responding to enquiries, complaints and safety concerns, and providing customer support; 
• personalising and improving the Platform, conducting analytics, quality assurance, testing and research; 
• preventing fraud, misuse, unsafe conduct and security incidents, and enforcing Platform rules; 
• meeting legal, regulatory, insurance, audit, taxation, accounting, NDIS and record-keeping obligations; 
• managing business relationships, corporate transactions, disputes and legal claims; and 
• sending direct marketing where permitted by law and managing communication preferences. 

7.2 MySolas will not use or disclose personal information for an unrelated secondary purpose unless the individual consents or the use or disclosure is otherwise authorised by the Privacy Act or another applicable law. 

8. MySolas Match and written consent 

8.1 MySolas team members review information supplied by a Participant or authorised Representative to identify potentially suitable Providers. 

8.2 MySolas does not disclose identifiable Participant information to a potential Provider unless the Participant or authorised Representative first agrees in writing to that disclosure. 

8.3 Before obtaining consent, MySolas will explain the information proposed to be shared, the Provider or category of Providers who may receive it, the purpose of the disclosure and any relevant consequences of agreeing or declining. 

8.4 MySolas may use de-identified or limited information to assess Provider suitability before written consent is obtained, provided the information does not identify and is not reasonably capable of identifying the Participant. 

8.5 MySolas may in future use artificial intelligence or automated tools to help shortlist or recommend Providers based on service offerings, location, availability and Participant preferences. Any such tool will support, not replace, MySolas team review. A MySolas team member will review and decide which Providers are proposed, and MySolas will update relevant notices before implementing materially new automated handling. 

9. Recruitment service 

9.1 MySolas offers recruitment services to eligible paid Provider members. MySolas may interview candidates, conduct reference checks, assess role suitability and communicate with candidates and Providers. 

9.2 MySolas will share a candidate's identifiable profile, interview information, reference information or other recruitment information with a Provider only after obtaining the candidate's written consent for that disclosure. 

9.3 MySolas may ask a candidate whether the candidate consents to retention of the candidate profile for consideration for future vacancies. If consent is not provided or is withdrawn, MySolas will remove the profile from active recruitment consideration and take reasonable steps to destroy or de-identify it when it is no longer lawfully required. 

9.4 A candidate may ask MySolas to stop representing the candidate, withdraw the candidate from a vacancy or remove the candidate from the active recruitment database, subject to information that MySolas is lawfully required or permitted to retain. 

10. Microsoft Teams AI note-taking 

10.1 MySolas may use Microsoft Teams AI note-taking, transcription or summarisation functionality during recruitment interviews to generate interview notes or meeting summaries for MySolas and the relevant Provider. 

10.2 Before AI note-taking is activated, MySolas will notify the candidate that transcription or AI summarisation will occur, explain the purpose and intended recipients, and obtain any consent required by law or MySolas policy. 

10.3 AI-generated notes or summaries may contain errors or omit context. A MySolas team member will review the output before it is relied upon or shared with a Provider. The AI output will not make the final recruitment decision. 

10.4 A candidate may raise concerns about AI note-taking or request a reasonable alternative before the interview. MySolas will consider the request having regard to legal requirements, accessibility needs and the practical requirements of the recruitment process. 

10.5 MySolas does not record ordinary telephone calls. This statement does not prevent disclosed and consented Microsoft Teams transcription or AI note-taking described in this clause. 

11. Disclosure of personal information 

11.1 MySolas may disclose personal information, where reasonably necessary and legally permitted, to: 

• Providers selected through MySolas Match after written Participant or Representative consent; 
• Provider employers receiving recruitment candidate information after written candidate consent; 
• authorised Representatives and persons the individual asks MySolas to contact; 
• AWS, Microsoft, Google, HubSpot, Stripe and other contracted technology, hosting, analytics, communications, payment, customer-management, security and support providers; 
• professional advisers, insurers, auditors, contractors and personnel who require access for authorised duties; 
• the NDIA, NDIS Quality and Safeguards Commission, police, emergency services, courts, tribunals, regulators and government bodies where disclosure is required, authorised or reasonably necessary under law; 
• a purchaser, investor or adviser in connection with a proposed corporate transaction, subject to appropriate confidentiality and privacy safeguards; and 
• other persons where the individual consents or would reasonably expect the disclosure for the primary purpose. 

11.2 MySolas does not sell personal information. MySolas does not disclose sensitive information for third-party direct marketing without the individual's express consent. 

12. Service providers and storage location 

12.1 MySolas uses service providers including Amazon Web Services (AWS), Stripe, Microsoft, Google and HubSpot. These providers support hosting, payments, productivity, communications, analytics, customer relationship management, security and related functions. 

12.2 MySolas configures its primary data storage to be located in Australia. Some service providers are global organisations, and limited personal information, service metadata, analytics data or support information may be accessed or processed from another country where required to provide support, security, analytics or other contracted services. 

12.3 Where personal information is likely to be disclosed to an overseas recipient, MySolas will identify likely countries in this Policy or a relevant collection notice where practicable and will take reasonable steps required by APP 8 to ensure appropriate handling. 

12.4 Likely overseas processing locations may change with provider infrastructure and support arrangements. At the date of this Policy, potential locations associated with global service providers may include the United States, Ireland or other European Economic Area countries, Singapore, New Zealand and other locations notified by the relevant provider. Primary MySolas storage remains configured in Australia. 

13. Cookies, analytics and tracking technologies 

13.1 MySolas uses essential cookies for security, authentication, account functionality and user preferences. It may also use analytics and advertising technologies, including Google Analytics, Google Tag Manager and Meta Pixel, to understand Platform use, measure communications and improve services. 

13.2 Depending on configuration, these technologies may collect device and browser details, IP address, pages viewed, interactions, referring pages, approximate location and identifiers associated with cookies or advertising systems. 

13.3 MySolas will take reasonable steps to configure tracking technologies to minimise collection, avoid unnecessary disclosure of sensitive information and provide appropriate notice or choice. Users may manage non-essential cookies through available consent tools or browser settings, although disabling cookies may affect functionality. 

13.4 Users should not enter sensitive information into free-text fields, URLs or pages where tracking technologies are not intended to collect it. MySolas will periodically review its tracking configuration and data flows. 

14. Direct marketing and communications 

14.1 MySolas may send operational communications necessary to administer an account, Membership, match, recruitment process, transaction, security issue or requested service. These are not marketing communications and may continue while the relevant service remains active. 

14.2 Where permitted by the Privacy Act, Spam Act 2003 (Cth) and other applicable law, MySolas may send marketing or promotional communications by email, SMS or Platform notification. 

14.3 Marketing communications will identify MySolas and provide a simple means to opt out where required. MySolas will action valid opt-out requests within the period required by law and without charge. 

14.4 MySolas will not use sensitive information for direct marketing unless the individual has given the consent required by law. 

14.5 An individual may update communication preferences through the Platform, use an unsubscribe function or contact the Privacy Officer. Opting out of marketing does not prevent essential service or legal communications. 

15. Government-related identifiers 

15.1 MySolas may collect government-related identifiers, including an NDIS participant number or screening reference, where reasonably necessary and lawful. 

15.2 MySolas will not adopt a government-related identifier as its own account identifier or use or disclose it except as permitted by APP 9 or other applicable law. 

16. Children, Participants and authorised Representatives 

16.1 An account concerning a person under 18 must be created and managed by a parent, guardian or authorised Representative. MySolas does not knowingly permit a minor to independently create or manage an account. 

16.2 A Representative must have lawful authority to act for the Participant and must provide accurate information. MySolas may request evidence of authority and may limit access where authority is unclear or disputed. 

16.3 MySolas will consider the Participant's capacity, maturity, circumstances, preferences and rights when determining who may provide consent, access information or exercise privacy rights. 

16.4 MySolas will seek to use accessible and understandable collection notices and consent processes for Participants and Representatives and will review its practices as children's online privacy requirements develop. 

17. Data quality 

17.1 MySolas takes reasonable steps to ensure that personal information it uses or discloses is accurate, up to date, complete and relevant, having regard to the purpose. 

17.2 Individuals and organisations should promptly update account details and notify MySolas if information is inaccurate, incomplete or no longer current. 

18. Security 

18.1 MySolas takes reasonable technical, administrative and physical steps to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure. 

18.2 Security measures may include Australian-region cloud hosting, encryption in transit, access controls, multi-factor authentication where available, logging and monitoring, staff confidentiality obligations, role-based access, backups, vendor assessment, security updates, incident response and periodic review. 

18.3 No internet or storage system can be guaranteed to be completely secure. Users must protect their credentials, use secure devices and promptly notify MySolas of suspected account compromise or unauthorised access. 

19. Retention, destruction and de-identification 

19.1 MySolas retains personal information only for as long as reasonably necessary for the purpose for which it was collected or a related permitted purpose, and to satisfy legal, accounting, taxation, insurance, audit, fraud prevention, complaints, dispute, safeguarding and record-keeping requirements. 

19.2 Retention periods differ by information category, sensitivity, service relationship, consent, legal risk and system capability. MySolas maintains internal retention and disposal practices that may be updated as operational or legal requirements change. 

19.3 When personal information is no longer required for a permitted purpose and is not required to be retained by law or a court or tribunal order, MySolas will take reasonable steps to destroy or de-identify it. 

19.4 Deletion may not immediately remove information from secure backups, audit logs or legal archives. Such information will remain protected, will not be used for ordinary operational purposes and will be removed or rendered inaccessible through the normal retention cycle. 

19.5 A candidate profile retained for future vacancies will remain active only while consent remains current and the information remains reasonably useful. If consent is declined or withdrawn, the profile will be removed from active recruitment consideration and handled under this clause. 

20. Access and correction 

20.1 An individual may request access to personal information MySolas holds about the individual and may request correction of information that is inaccurate, out of date, incomplete, irrelevant or misleading. 

20.2 Requests should be sent to the Privacy Officer. MySolas may require reasonable identity verification before providing access or making a correction. 

20.3 MySolas will respond within a reasonable period, ordinarily within 30 calendar days. MySolas will not charge for making a request or correcting personal information. A reasonable access charge may apply only where permitted by law and notified in advance. 

20.4 MySolas may refuse or limit access where permitted by the Privacy Act, including where access would unreasonably affect another person's privacy, reveal commercially sensitive evaluative information, prejudice an investigation or be unlawful. MySolas will provide written reasons and complaint information where required. 

20.5 Where MySolas refuses to correct information, an individual may request that a statement be associated with the information noting the individual's view that it is inaccurate, out of date, incomplete, irrelevant or misleading. 

21. Account closure, withdrawal and deletion requests 

21.1 An individual may request account closure, withdrawal of consent or deletion of particular information by contacting MySolas. 

21.2 Australia does not provide an unrestricted right to immediate deletion in every circumstance. MySolas will assess each request under the APPs and applicable law and may retain information where reasonably necessary or legally required, including for payment records, fraud prevention, complaints, safeguarding, legal claims, audit trails or record-keeping obligations. 

21.3 Where information is no longer required and no lawful retention basis applies, MySolas will take reasonable steps to destroy or de-identify it. 

21.4 Withdrawal of consent applies prospectively and may prevent MySolas from continuing the relevant service. It does not require deletion of information that MySolas remains lawfully entitled or required to retain. 

22. Data breaches 

22.1 MySolas maintains processes for identifying, containing, investigating, assessing and responding to suspected data breaches. 

22.2 Where MySolas has reasonable grounds to suspect an eligible data breach, it will conduct the assessment required by the Privacy Act and take reasonable steps to reduce the risk of harm. 

22.3 If an eligible data breach is likely to result in serious harm and remedial action has not prevented that risk, MySolas will notify affected individuals and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme. 

23. Privacy complaints 

23.1 A person who believes MySolas has interfered with privacy or mishandled personal information may make a written complaint to the MySolas Privacy Officer using the contact details in clause 24. 

23.2 The complaint should describe the concern, relevant dates, persons or services involved and the outcome sought. MySolas may request further information where reasonably necessary. 

23.3 MySolas will acknowledge and investigate the complaint and aims to provide a substantive written response within 30 calendar days. If additional time is reasonably required, MySolas will explain the reason and provide an expected response date. 

23.4 If the complainant is not satisfied with MySolas's response, the complainant may contact the Office of the Australian Information Commissioner at https://www.oaic.gov.au/privacy/privacy-complaints. 

24. Contact details 

24.1 Privacy Officer: MySolas Privacy Officer 

24.2 Email: hello@mysolas.com.au 

24.3 Postal address: Level 2, 106 City Road, Beenleigh QLD 4207 

24.4 Website: https://www.mysolas.com.au 

25. Changes to this Privacy Policy 

25.1 MySolas may update this Policy to reflect changes in law, technology, services, data practices or business operations. 

25.2 The current version will be published at https://www.mysolas.com.au/privacy-policy with the updated date. MySolas will provide additional notice of a material change where reasonable and will obtain fresh consent where required for a materially new handling activity. 

25.3 Continued use of the Platform after an update does not by itself constitute consent to a handling activity for which express consent is required by law. 

Schedule 1 | Operational privacy commitments 

This Schedule summarises operational commitments reflected in the Policy. It is intended to assist implementation and should remain consistent with MySolas systems and staff procedures. 

1. MySolas Match 

• Do not disclose identifiable Participant information to a Provider without written Participant or authorised Representative consent. 
• Record what information may be shared, with whom and for what purpose. 
• Use human review for all Provider shortlists and final recommendations. 

2. Recruitment 

• Obtain written candidate consent before sharing a candidate profile or interview information with a Provider. 
• Obtain separate consent before retaining a profile for future vacancies. 
• Remove candidates from active representation when requested, subject to lawful retention. 

3. Microsoft Teams AI notes 

• Notify candidates before AI transcription or note-taking begins. 
• Explain the purpose and intended recipients of the summary. 
• Require human review before the summary is relied upon or shared. 

4. Tracking technologies 

• Maintain an inventory of Google Analytics, Google Tag Manager, Meta Pixel and other tracking tools. 
• Configure tracking to minimise collection and avoid sensitive-information leakage. 
• Maintain appropriate user notice and controls for non-essential technologies. 

5. Retention and disposal 

• Maintain an internal schedule by information category and system. 
• Destroy or de-identify information when no longer required for a lawful purpose. 
• Document legal holds, backup limitations and exceptions to ordinary disposal. 

6. Privacy requests and incidents 

• Verify identity before releasing personal information. 
• Aim to respond to access, correction and privacy complaints within 30 calendar days. 
• Escalate suspected data breaches promptly for assessment under the NDB scheme.